FineUploader php-traditional-server unauthenticated arbitrary file upload vulnerability

CRITICAL 9.8CVE-2018-9209 · GHSA-j78w-6r73-22vh · Published 19/11/2018 · updated 17/06/2026

In short

CVE-2018-9209 is a CRITICAL (CVSS 9.8) vulnerability affecting fineuploader/php-traditional-server, php-traditional-server (fineuploader).
Chance of exploitation in the next 30 days (EPSS): 1.8%, higher than 79.1% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
fineuploader/php-traditional-server Packagist	`≤ 1.2.2`	No fix yet
php-traditional-server fineuploader	`≤ 1.2.2`	No fix yet

Unauthenticated arbitrary file upload vulnerability in FineUploader php-traditional-server <= v1.2.2

NVD description

Unauthenticated arbitrary file upload vulnerability in FineUploader php-traditional-server <= v1.2.2

Running one of these products? Scan your site to see whether it exposes a vulnerable version.